Medium severity · published Jun 25, 2024
CVE-2024-32111
WordPress core < 6.5.5 - Auth. Arbitrary .html File Read (Windows Only) vulnerability
5.0
CVSS
0.5%
EPSS
No
On KEV
Description
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Automattic WordPress allows Relative Path Traversal.This issue affects WordPress: from 6.5 through 6.5.4, from 6.4 through 6.4.4, from 6.3 through 6.3.4, from 6.2 through 6.2.5, from 6.1 through 6.1.6, from 6.0 through 6.0.8, from 5.9 through 5.9.9, from 5.8 through 5.8.9, from 5.7 through 5.7.11, from 5.6 through 5.6.13, from 5.5 through 5.5.14, from 5.4 through 5.4.15, from 5.3 through 5.3.17, from 5.2 through 5.2.20, from 5.1 through 5.1.18, from 5.0 through 5.0.21, from 4.9 through 4.9.25, from 4.8 through 4.8.24, from 4.7 through 4.7.28, from 4.6 through 4.6.28, from 4.5 through 4.5.31, from 4.4 through 4.4.32, from 4.3 through 4.3.33, from 4.2 through 4.2.37, from 4.1 through 4.1.40.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WO
WordPress · Automattic
6.5 through 6.5.4; 6.4 through 6.4.4; 6.3 through 6.3.4; 6.2 through 6.2.5; 6.1 through 6.1.6; 6.0 through 6.0.8; +19 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-32111
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-32111
patchstack.com
https://patchstack.com/database/vulnerability/wordpress/wordpress-core-6-5-5-contributor-arbitrary-html-file-read-windows-only-vulnerability?_s_id=cve
wordpress.org
https://wordpress.org/news/2024/06/wordpress-6-5-5/
More from WordPress
7.1
CVE-2026-93485
WordPress Core <= 7.1 - Cross Site Scripting (XSS) vulnerability
6.9
CVE-2026-66666
WordPress Core <= 7.1.2 - Unauthenticated Sensitive Data Exposure of Comments on Private and Unpublished Posts via Comment Feed vulnerability
6.5
CVE-2024-31111
WordPress Core < 6.5.5 - Cross Site Scripting (XSS) vulnerability
